@financial-times/pro-ask-ft-kit

This package contains the Shared utils between App and Web versions & UI components for App version, which will give us the freedom to develop our components in isolation using TS & React giving us a better DevX

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

the-ftrowanmanningcheealexwilsonaendraemmalewisnotleeseraph2000hamza.samihrobertboultonrobgodfrey

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
phantom-deps	phantom-dep:@financial-times/o3-tooltip	AI (phantom-deps): Same org scope; likely used indirectly via CSS/design tokens rather than direct JS import.	ai	2026/05/13
phantom-deps	phantom-dep:@financial-times/o3-foundation	AI (phantom-deps): Same org scope; likely used indirectly via CSS/design tokens rather than direct JS import.	ai	2026/05/13
source-diff	obfuscated-file:dist/node_modules/parse5/node_modules/entities/dist/esm/generated/decode-data-html.js	AI (source-diff): HTML entity decode table for parse5/entities — known minified data file, not malicious obfuscation.	ai	2026/05/13
source-diff	obfuscated-file:dist/node_modules/parse5/dist/common/error-codes.js	AI (source-diff): Minified parse5 error-codes enum — legitimate bundled dependency of react-markdown.	ai	2026/05/13
source-diff	source-size-tripled	AI (source-diff): Size increase explained by bundling parse5 and entities as transitive deps of react-markdown/rehype-raw.	ai	2026/05/13
source-diff	large-new-source-files	AI (source-diff): 188 new files are parse5/entities bundle artifacts from newly added react-markdown dependency.	ai	2026/05/13
source-diff	obfuscated-file:dist/images/ask-ft-generating.json.js	AI (source-diff): File is a base64-encoded Lottie animation asset, not obfuscated malicious code. Stable pattern for this package.	ai	2026/05/07
source-diff	obfuscated-file:dist/images/generating-animation.gif.js	AI (source-diff): File is a base64-encoded GIF data URI assigned to a JS constant — not obfuscated code.	ai	2026/05/07
phantom-deps	phantom-dep:date-fns	AI (phantom-deps): Declared dependency; used indirectly via react-markdown. Stable false positive.	ai	2026/05/07
phantom-deps	phantom-dep:rehype-raw	AI (phantom-deps): Declared dependency; used indirectly via react-markdown. Stable false positive.	ai	2026/05/07
phantom-deps	phantom-dep:use-sync-external-store	AI (phantom-deps): Declared dependency; used indirectly via React. Stable false positive.	ai	2026/05/07

Versions (showing 51 of 82)

View all versions

Version	Deps	Published
0.4.1	3 / 34	2026-04-30
0.4.0	3 / 34	2026-04-29
0.3.11	3 / 34	2026-04-23
0.3.10	3 / 34	2026-04-07
0.3.9	3 / 34	2026-02-19
0.3.8	3 / 34	2026-02-16
0.3.7	3 / 34	2026-02-16
0.3.6	3 / 34	2026-02-16
0.3.5	3 / 34	2026-02-16
0.3.4	3 / 34	2026-01-27
0.3.3	3 / 34	2026-01-26
0.3.2	3 / 34	2026-01-22
0.3.1	3 / 34	2026-01-14
0.3.0	3 / 34	2026-01-14
0.2.9	3 / 34	2025-11-26
0.2.8	3 / 34	2025-11-19
0.2.7	3 / 34	2025-11-10
0.2.6	3 / 34	2025-11-06
0.2.5	3 / 34	2025-11-05
0.2.4	3 / 34	2025-11-04
0.2.3	3 / 34	2025-11-03
0.2.2	4 / 34	2025-11-02
0.2.1	4 / 34	2025-10-31
0.2.0	4 / 34	2025-10-30
0.1.4	2 / 34	2025-10-27
0.1.3	2 / 34	2025-10-16
0.1.2	2 / 34	2025-10-13
0.1.1	2 / 34	2025-10-10
0.1.0	2 / 34	2025-09-29
0.0.67	2 / 34	2025-09-24
0.0.66	2 / 34	2025-09-23
0.0.65	2 / 34	2025-09-18
0.0.64	2 / 34	2025-09-11
0.0.63	2 / 34	2025-09-11
0.0.62	2 / 34	2025-08-28
0.0.61	2 / 34	2025-08-22
0.0.60	2 / 34	2025-08-22
0.0.59	2 / 34	2025-08-21
0.0.58	2 / 34	2025-08-21
0.0.57	2 / 34	2025-08-18
0.0.56	2 / 35	2025-08-15
0.0.55	2 / 35	2025-08-12
0.0.54	2 / 35	2025-08-12
0.0.53	2 / 35	2025-08-11
0.0.52	2 / 35	2025-08-08
0.0.51	2 / 35	2025-08-08
0.0.50	2 / 35	2025-08-08
0.0.49	2 / 35	2025-08-08
0.0.48	2 / 35	2025-08-08
0.0.47	2 / 35	2025-08-07
0.0.46	2 / 35	2025-08-07

v0.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.11

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.9

2 findings

HIGH New obfuscated file: dist/images/ask-ft-generating.json.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.8

2 findings

HIGH New obfuscated file: dist/images/ask-ft-generating.json.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.7

2 findings

HIGH New obfuscated file: dist/images/ask-ft-generating.json.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.6

2 findings

HIGH New obfuscated file: dist/images/ask-ft-generating.json.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.5

2 findings

HIGH New obfuscated file: dist/images/ask-ft-generating.json.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.4

2 findings

HIGH New obfuscated file: dist/images/ask-ft-generating.json.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.3

2 findings

HIGH New obfuscated file: dist/images/ask-ft-generating.json.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.2

2 findings

HIGH New obfuscated file: dist/images/ask-ft-generating.json.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.1

2 findings

HIGH New obfuscated file: dist/images/ask-ft-generating.json.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.3.0

2 findings

HIGH New obfuscated file: dist/images/ask-ft-generating.json.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.9

2 findings

HIGH New obfuscated file: dist/images/ask-ft-generating.json.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.8

2 findings

HIGH New obfuscated file: dist/images/ask-ft-generating.json.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.7

2 findings

HIGH New obfuscated file: dist/images/generating-animation.gif.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.6

2 findings

HIGH New obfuscated file: dist/images/generating-animation.gif.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.2.1

3 findings

HIGH New obfuscated file: dist/node_modules/parse5/node_modules/entities/dist/esm/generated/decode-data-html.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/node_modules/parse5/dist/common/error-codes.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.2.0

3 findings

HIGH New obfuscated file: dist/node_modules/parse5/node_modules/entities/dist/esm/generated/decode-data-html.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: dist/node_modules/parse5/dist/common/error-codes.js source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.1.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.67

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.66

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.65

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.64

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.63

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.62

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.61

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.60

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.59

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.58

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.57

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.56

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.55

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.54

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.53

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.52

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.51

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.50

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.49

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.48

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.47

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.0.46

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.